Issue PHP Mail log

[mazaamahesh]

My server sending spam emails. I have already enabled SMTP authentication for all domains. but still, there is a spambot on the server or php script which is sending spam emails.

there is no log in smartermail because script is not using smartermail to send email.

how can i create a php mail log to track the script?

 

[PavelV]

Hello,

If I understand correctly, one of your domains uses scripts to open direct SMTP connections to external servers and send some emails avoiding your local SmarterMail. Right?
In this case, you will not see anything in SmarterMail logs, of course, because there is no SMTP activity through local mail server.

If you want to track such activity you can try to use utility Process Monitor from Microsoft (former sysinternals.com) - Process Monitor

After it is started, you need to select in toolbar which activity you want to monitor: please turn off disk and registry activity and leave only "Network activity".

After that go to "Filter -> Filter..." and configure the following rule:

Add it.

Now, you should see only SMTP activity on your server.

If you will see some processes that are trying to connect to external servers using SMTP, you can select such line, open Event properties and try to discover what is that process. For example, if this is PHP process, then probably you can found user launched this process, after that it is possible to understand which subscription it belongs to.

I hope this can help you.

 

[mazaamahesh]

Dear Pavel,

Thanks, for the reply. I already using the Process Monitor with exact steps and I found many spam scripts and removed it from the server, using the following source as you told me.

How to identify source / script of spam IIS 7

but process monitor eats virtual memory very fast and my server gets down shortly with 30 to 45 minutes.

so is there any other way? like php mail log?